feat: store editor images in upload bind

README.md

@@ -136,8 +136,9 @@ service itself is stopped, restore it and run the caller command again.
 
 ### Short-lived user-icon uploads
 
-Core and Core2026 can store validated account icons in this repository through
-`PUT /v1/uploads/user-icons/<client>/<random-32-hex>.<extension>`. Each game
+Core and Core2026 can store validated account icons and editor attachments
+through this service with
+`PUT /v1/uploads/<user-icons|content>/<client>/<random-32-hex>.<extension>`. Each game
 server validates the authenticated user and image first, then sends the raw
 image body with `X-Image-Client`, `X-Image-Expires`, `X-Image-Request-Id`, and
 `X-Image-Signature` headers.
@@ -148,7 +149,9 @@ five minutes in the future, so a grant cannot be reused for another path,
 content type, body, or later upload. The service also checks the image magic,
 caller scope, and request replay before it writes one immutable file below the
 host bind directory `runtime-data/uploads`. User uploads are deliberately not
-added to Git; Nginx exposes that bind read-only at `/icons/users/`.
+added to Git; Nginx exposes that bind read-only at `/icons/users/` for account
+icons and `/uploads/` for editor content. User icons retain the 50KB limit;
+editor content retains the existing 1MB limit.
 
 Create separate upload secrets with `deploy/scripts/init-secrets.sh`. Mount only
 the matching `image_upload_core_secret` or `image_upload_core2026_secret` on the